Microsoft LAPSUS$ Breach (2022): One Account, Limited Access, and a 37GB Claim

On this page: Timeline · Confirmed vs claimed · The playbook and its controls · Three corrections · Common questions

How the Microsoft LAPSUS$ breach came out

LAPSUS$ told the world first. Over the weekend of March 19 to 21, 2022, the group posted screenshots of what it said were Microsoft's internal source-code repositories. Then, on the night of March 21, it put up a torrent for a 9GB compressed archive. According to LAPSUS$, that held 37GB of partial source code for more than 250 projects.

Microsoft confirmed it on March 22, in a short passage on its security blog, tucked inside a much longer profile of the group it called DEV-0537. Its team was already looking into the account based on threat intelligence. The group's public bragging, Microsoft said, let it step in and interrupt the actor "mid-operation, limiting broader impact."

Microsoft LAPSUS$ timeline

What Microsoft said, and where every other detail came from

The LAPSUS$ playbook, and the controls that answer it

Since Microsoft never disclosed how it was hit, the useful record is what the group did to many victims. The table runs in attack order, and each control is credited to whoever recommends it.

Then there's the insider angle, which is unusual. Microsoft describes the deal: for a fee, an accomplice would hand over credentials and approve the MFA prompt, or install remote-access software. The CSRB adds that the group offered up to USD 20,000 per week for SIM swaps at several telecom providers. That was an advertised offer. Nobody has shown it was actually paid.

Three corrections to how this case usually gets told

"A single employee account"

Microsoft wrote "a single account." TechCrunch and others added the word employee. That's not a small change, because the group recruited outside contractors and suppliers too.

The 1am prompt detail

There's a claim going around that the government review flagged MFA prompts sent at 1am. The CSRB report doesn't give an hour. It only says some prompts came late at night or at inconvenient times.

What the CSRB says about number matching and help desks

The Board doesn't brush off number matching. Appendix B says CISA recommends it over simple push, because the extra step helps against MFA fatigue, though it can still be phished. And the help-desk advice people often credit to the Board actually comes from Microsoft. The CSRB report makes no help-desk recommendation.

Why LAPSUS$ got caught so fast

LAPSUS$ was loud. It announced victims on its own Telegram channel and posted stolen code before companies had confirmed anything. All that noise is how the Microsoft breach became public, and by Microsoft's account it helped its team cut the intrusion short.

Arrests came within days. Later UK proceedings found that one member did the acts in attacks on Uber, Revolut and Rockstar Games, which the Uber 2022 breach case covers. None of those findings involved Microsoft. The CSRB review afterwards was the Board's first look at a purely criminal group with no state behind it.

You'll see the same moves in other cases here. The EA Slack breach of 2021 has the help-desk step. For the prompt flood in full, read the Uber case.

LAPSUS$ and Microsoft: common questions

Reviewed by the SEE Team. This case was written from Microsoft's disclosure, the CSRB report and the reports listed below, and checked against them before release. See how cases are sourced and reviewed and who runs this library.